MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Adware.360SafeBrowse

Vendor detections: 13

Intelligence 13 IOCs YARA 21 File information Comments

SHA256 hash:	d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18
SHA3-384 hash:	eda0f6241de6b71c9884f2cfb196dd4aa790f24a8681a5008e40560f3d75779c7e90509abc963c3ed57bbc3b7ae17a6f
SHA1 hash:	0609b6e551ae04085b9b1e39a053365b498377d1
MD5 hash:	552d979fea44774298a7bc6c40f9044d
humanhash:	nebraska-failed-mirror-three
File name:	d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18.exe
Download:	download sample
Signature	Adware.360SafeBrowse Create hunting rule
File size:	1'008'776 bytes
First seen:	2026-11-13 00:48:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	e450699ab5212aaec51dcc1a43a85d7c (1 x Adware.360SafeBrowse)
ssdeep	24576:mHB/e7SdgIMw6fr967Vqr8Oe4Jz2gRWQQQQQQQQQQ+QQQQQQQQQQQQQQlQQQQQQs:+SSdFMC7kxJz3WQQQQQQQQQQ+QQQQQQy
TLSH	T1EF256C11F2B2F039CD96D0FD8AEB537B582C9B254B94BCC7E2845D6E2B103D0B57528A
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	f0f82026a464e070 (2 x ValleyRAT, 1 x Adware.360SafeBrowse, 1 x Adware.Qihoo360)
Reporter	Tuxxin
Tags:	Adware.360SafeBrowse exe signed

Code Signing Certificate

Organisation:	Beijing Qihu Technology Co., Ltd.
Issuer:	GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-04-26T03:04:42Z
Valid to:	2026-04-26T03:04:42Z
Serial number:	295bf86e852653403313837b
Intelligence:	12 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	24e8dd56e4359351eef5c22d201ffb991e923343d8db03398c6de05656f7ef4c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

213

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

https://www.bing.com/ck/a?!&&p=01b0c0bcc04e16b24733611b962891ce79062f3580d8955263b19f4fd89979abJmltdHM9MTc5MDcyNjQwMA&ptn=3&ver=2&hsh=4&fclid=097bf274-ce2f-69a6-1ecf-e590cf34687f&psq=360drvmgr&u=a1aHR0cDovL2RtLndlaXNoaS4zNjAuY24vaG9tZS5odG1s

Verdict:

Malicious activity

Analysis date:

2026-09-30 14:59:14 UTC

Tags:

qrcode loader arch-exec qihoo360 adware arch-doc computerz-sys vuln-driver evasion arch-html

Link:

https://app.any.run/tasks/fb344ab5-99d1-48d8-8539-6eb3dfddf06b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99728/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af65e8783200b505eda5608

Tags:

ransomware injection virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Creating a window

DNS request

Launching a process

Connection attempt

Searching for the window

Sending an HTTP GET request

Sending a custom TCP request

Creating a file

Creating a file in the %temp% directory

Deleting a recently created file

Searching for synchronization primitives

Changing a file

Creating a process with a hidden window

Reading critical registry keys

Moving a recently created file

Replacing files

Delayed writing of the file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm base64 crypto expired-cert fingerprint microsoft_visual_cc overlay packed reconnaissance signed

Link:

https://www.filescan.io/uploads/6af65e85ba23d1e52550d4a9/reports/4bb2f55f-e173-45f2-bf54-143d4a9a11df/overview

Verdict:

Malicious

Labled as:

Win32_Qihoo360_K_potentially_unwanted_application

Link:

https://www.hybrid-analysis.com/sample/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18

Verdict:

Clean

File Type:

exe x32

First seen:

2025-12-16T05:59:00Z UTC

Last seen:

2026-11-05T06:07:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/c40bc378-f437-4a5c-896c-f89f40f51001

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1974053

Signature

Allocates memory in foreign processes

Benign windows process drops PE files

Detected potential unwanted application

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Injects code into the Windows Explorer (explorer.exe)

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Unusual module load detection (module proxying)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Score:

68%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/552d979fea44774298a7bc6c40f9044d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3gpls6gwykrkon5gztywiqnensb2475avobhoihjk7w2j535xima._file

Result

Malware family:

n/a

Score:

6/10

Tags:

bootkit defense_evasion discovery persistence

Link:

https://tria.ge/reports/261113-b3pfcaev91/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Browser Information Discovery

Direct Volume Access: Opens a physical disk for reading

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

System Time Discovery

Checks installed software on the system

Drops file in Program Files directory

Drops file in Windows directory

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks for any installed AV software in registry

Writes to the Master Boot Record (MBR)

Malware Family:

n/a

Verdict:

Suspicious

Tags:

evasion

YARA:

n/a

Link:

https://app.threat.zone/submission/439c7837-8278-4213-b6c2-926c754cf8a1

Malware Family:

qihoo360

Malicious:

True

Tags:

malware signed exe debug-check file-overlay exec-delay env-check persistence

Link:

https://intel.virussign.com/intelligence/file/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18

Unpacked files

SH256 hash:

d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18

MD5 hash:

552d979fea44774298a7bc6c40f9044d

SHA1 hash:

0609b6e551ae04085b9b1e39a053365b498377d1

Link:

https://www.unpac.me/results/19c6c7c3-72fc-4a06-859e-7695a9dd434c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BlackGuard_Rule Create hunting rule
Author:	Jiho Kim
Description:	Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:	https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection

Rule name:	data_manipulation Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)

Rule name:	WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Fantom (pe, etat extrait)

Rule name:	WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd Create hunting rule
Author:	Marjoriefort
Description:	Detects PythonStealer (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_7b770d80 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_ac9e4d5b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.360SafeBrowse

exe d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/99728/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample